Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #178081 > unrolled thread

Secure Boot won't let boot into Debian

Back to article view | Back to linux.debian.user

Contents

  Secure Boot won't let boot into Debian Rodolfo Medina <rodolfo.medina@gmail.com> - 2017-02-22 22:50 +0100
    Re: Secure Boot won't let boot into Debian Sven Hartge <sven@svenhartge.de> - 2017-02-22 23:30 +0100
    Re: Secure Boot won't let boot into Debian Mark Fletcher <mark27q1@gmail.com> - 2017-02-23 13:00 +0100
      Re: Secure Boot won't let boot into Debian Rodolfo Medina <rodolfo.medina@gmail.com> - 2017-02-23 16:00 +0100
    Re: Secure Boot won't let boot into Debian Eero Volotinen <eero.volotinen@iki.fi> - 2017-02-23 13:40 +0100
      Re: Secure Boot won't let boot into Debian Rodolfo Medina <rodolfo.medina@gmail.com> - 2017-02-23 15:30 +0100
        Re: Secure Boot won't let boot into Debian Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-02-23 20:50 +0100
    Re: Secure Boot won't let boot into Debian Steve McIntyre <steve@einval.com> - 2017-02-23 18:00 +0100
      Re: Secure Boot won't let boot into Debian Ric Moore <wayward4now@gmail.com> - 2017-02-23 18:40 +0100
      Re: Secure Boot won't let boot into Debian Rodolfo Medina <rodolfo.medina@gmail.com> - 2017-02-23 20:40 +0100
        Re: Secure Boot won't let boot into Debian Steve McIntyre <steve@einval.com> - 2017-02-24 01:40 +0100
          Re: Secure Boot won't let boot into Debian Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-02-24 07:20 +0100
            Re: Secure Boot won't let boot into Debian Steve McIntyre <steve@einval.com> - 2017-02-24 14:50 +0100
    Re: Secure Boot won't let boot into Debian GiaThnYgeia <GiaThnYgeia@openmailbox.org> - 2017-02-23 21:40 +0100
    [solved?] Re: Secure Boot won't let boot into Debian Rodolfo Medina <rodolfo.medina@gmail.com> - 2017-02-25 09:40 +0100
      Re: [solved?] Re: Secure Boot won't let boot into Debian Rodolfo Medina <rodolfo.medina@gmail.com> - 2017-02-25 10:10 +0100
        Re: [solved?] Re: Secure Boot won't let boot into Debian Rodolfo Medina <rodolfo.medina@gmail.com> - 2017-02-25 12:00 +0100
          Re: [solved?] Re: Secure Boot won't let boot into Debian GiaThnYgeia <GiaThnYgeia@openmailbox.org> - 2017-02-25 13:30 +0100
            Re: [solved?] Re: Secure Boot won't let boot into Debian Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-02-25 14:00 +0100
              Re: [solved?] Re: Secure Boot won't let boot into Debian Rodolfo Medina <rodolfo.medina@gmail.com> - 2017-02-25 14:10 +0100
                Re: [solved?] Re: Secure Boot won't let boot into Debian deloptes <deloptes@gmail.com> - 2017-02-25 14:30 +0100
                Re: [solved?] Re: Secure Boot won't let boot into Debian Ben Caradoc-Davies <ben@transient.nz> - 2017-02-25 23:50 +0100
                  Re: [solved?] Re: Secure Boot won't let boot into Debian Rodolfo Medina <rodolfo.medina@gmail.com> - 2017-02-28 08:30 +0100
      Re: [solved?] Re: Secure Boot won't let boot into Debian Patrick Bartek <nemommxiv@gmail.com> - 2017-02-25 16:10 +0100

Page 1 of 2  [1] 2  Next page →

#178081 — Secure Boot won't let boot into Debian

Hi all.

I frehly installed Debian Sid in dual boot with Windows 10 on my brand new
Lenovo desktop pc but it won't boot into Debian system I suspect because of the
new Secure Boot policy.  I want to disable it but the problem is that there's
no Secure Boot option anywhere in its Bios.  In fact, in the Security submenu,
there are only the options for administrator and power-on password setting.

What do you suggest me to do?

Thanks for any help,

Rodolfo

[toc] | [next] | [standalone]

#178082

Rodolfo Medina <rodolfo.medina@gmail.com> wrote:

> I frehly installed Debian Sid in dual boot with Windows 10 on my brand
> new Lenovo desktop pc but it won't boot into Debian system I suspect
> because of the new Secure Boot policy.  I want to disable it but the
> problem is that there's no Secure Boot option anywhere in its Bios.
> In fact, in the Security submenu, there are only the options for
> administrator and power-on password setting.

> What do you suggest me to do?

As far as I know support for Security Boot is not quite ready in Debian.
It is getting there, but it is not yet complete.

Last I heard from this (from Ben Hutchings I believe) the status was as
following:

 - the kernel is signed, but this is a manual process, needs automating
   + this in turn needs a secure way to store and access the key
     on a server -> a HSM
 - the bootloader shim was sent to be signed by Microsoft

See also https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820036 and
https://wiki.debian.org/SecureBoot

Grüße,
Sven.

-- 
Sigmentation fault. Core dumped.

[toc] | [prev] | [next] | [standalone]

#178094

On Wed, Feb 22, 2017 at 09:40:57PM +0000, Rodolfo Medina wrote:
> Hi all.
> 
> I frehly installed Debian Sid in dual boot with Windows 10 on my brand new
> Lenovo desktop pc but it won't boot into Debian system I suspect because of the
> new Secure Boot policy.  I want to disable it but the problem is that there's
> no Secure Boot option anywhere in its Bios.  In fact, in the Security submenu,
> there are only the options for administrator and power-on password setting.
> 
> What do you suggest me to do?
> 
Your description of the Bios menu makes it sound SO spartan I almost 
wonder if there isn't ANOTHER menu with other options. Some BIOSes put 
the boot menu on a different menu eg F10 to get into one, Esc or F2 or 
something to get into the other.

There ARE some BIOSes that have just locked it down completely and eff 
you if you aren't running a Microsoft operating system, but those are 
thankfully still rare. There are more of them here in Japan where 
consumers tend to be more docile... I hope that isn't a trend that is 
going to reach the rest of the world in force.

Mark

[toc] | [prev] | [next] | [standalone]

#178107

Mark Fletcher <mark27q1@gmail.com> writes:

> On Wed, Feb 22, 2017 at 09:40:57PM +0000, Rodolfo Medina wrote:
>> Hi all.
>> 
>> I frehly installed Debian Sid in dual boot with Windows 10 on my brand new
>> Lenovo desktop pc but it won't boot into Debian system I suspect because of
>> the new Secure Boot policy.  I want to disable it but the problem is that
>> there's no Secure Boot option anywhere in its Bios.  In fact, in the
>> Security submenu, there are only the options for administrator and power-on
>> password setting.
>> 
>> What do you suggest me to do?
>> 
> Your description of the Bios menu makes it sound SO spartan I almost 
> wonder if there isn't ANOTHER menu with other options. Some BIOSes put 
> the boot menu on a different menu eg F10 to get into one, Esc or F2 or 
> something to get into the other.
>
> There ARE some BIOSes that have just locked it down completely and eff 
> you if you aren't running a Microsoft operating system


Mine could be one of those...  In that case, any thing to do?

Rodolfo

[toc] | [prev] | [next] | [standalone]

#178095

[Multipart message — attachments visible in raw view] — view raw

UBuntu supports secure boot, if you cannot disable it from bios.

Eero

2017-02-22 23:40 GMT+02:00 Rodolfo Medina <rodolfo.medina@gmail.com>:

> Hi all.
>
> I frehly installed Debian Sid in dual boot with Windows 10 on my brand new
> Lenovo desktop pc but it won't boot into Debian system I suspect because
> of the
> new Secure Boot policy.  I want to disable it but the problem is that
> there's
> no Secure Boot option anywhere in its Bios.  In fact, in the Security
> submenu,
> there are only the options for administrator and power-on password setting.
>
> What do you suggest me to do?
>
> Thanks for any help,
>
> Rodolfo
>
>

[toc] | [prev] | [next] | [standalone]

#178103

Eero Volotinen <eero.volotinen@iki.fi> writes:

> UBuntu supports secure boot, if you cannot disable it from bios.
>
> Eero
>
> 2017-02-22 23:40 GMT+02:00 Rodolfo Medina <rodolfo.medina@gmail.com>:
>
>     Hi all.
>     
>     I frehly installed Debian Sid in dual boot with Windows 10 on my brand
>     new Lenovo desktop pc but it won't boot into Debian system I suspect
>     because of the new Secure Boot policy. I want to disable it but the
>     problem is that there's no Secure Boot option anywhere in its Bios. In
>     fact, in the Security submenu, there are only the options for
>     administrator and power-on password setting.
>     
>     What do you suggest me to do?


I installed Ubuntu but it won't boot into it either...

Rodolfo

[toc] | [prev] | [next] | [standalone]

#178119

Le 23/02/2017 à 15:26, Rodolfo Medina a écrit :
>>
>>     I frehly installed Debian Sid in dual boot with Windows 10 on my brand
>>     new Lenovo desktop pc but it won't boot into Debian system I suspect
>>     because of the new Secure Boot policy.  (...)
>
> I installed Ubuntu but it won't boot into it either...

If the Debian or Ubuntu installer boots, then I doubt it is a secure 
boot issue.

I would suggest to boot the installer again in rescue mode, run a shell 
in the installed system, and check some things such as the EFI boot 
paramaters with efibootmgr, the installation of GRUB in the EFI system 
partition...

[toc] | [prev] | [next] | [standalone]

#178114

rodolfo.medina@gmail.com wrote:
>Hi all.
>
>I frehly installed Debian Sid in dual boot with Windows 10 on my brand new
>Lenovo desktop pc but it won't boot into Debian system I suspect because of the
>new Secure Boot policy.  I want to disable it but the problem is that there's
>no Secure Boot option anywhere in its Bios.  In fact, in the Security submenu,
>there are only the options for administrator and power-on password setting.
>
>What do you suggest me to do?

Are you totally sure it's a Secure Boot issue? What exactly happens at
boot? Does it just boot straight into the Windows installation? Have
you managed to install Debian, or will it just not boot the installer?

If you go into the BIOS/firmware config program, does that show you a
list of boot options including Windows?

-- 
Steve McIntyre, Cambridge, UK.                                steve@einval.com
< sladen> I actually stayed in a hotel and arrived to find a post-it
          note stuck to the mini-bar saying "Paul: This fridge and
          fittings are the correct way around and do not need altering"

[toc] | [prev] | [next] | [standalone]

#178116

On 02/23/2017 11:50 AM, Steve McIntyre wrote:
> rodolfo.medina@gmail.com wrote:
>> Hi all.
>>
>> I frehly installed Debian Sid in dual boot with Windows 10 on my brand new
>> Lenovo desktop pc but it won't boot into Debian system I suspect because of the
>> new Secure Boot policy.  I want to disable it but the problem is that there's
>> no Secure Boot option anywhere in its Bios.  In fact, in the Security submenu,
>> there are only the options for administrator and power-on password setting.
>>
>> What do you suggest me to do?
>
> Are you totally sure it's a Secure Boot issue? What exactly happens at
> boot? Does it just boot straight into the Windows installation? Have
> you managed to install Debian, or will it just not boot the installer?
>
> If you go into the BIOS/firmware config program, does that show you a
> list of boot options including Windows?

I just installed a new ASUS motherboard and the bootup screen proclaims 
UEFI. I had plugged back in my two harddrives with Debian and Ubuntu 
installed. No sweat! Nothing different happened. I am clueless, but it 
works. Ric


-- 
My father, Victor Moore (Vic) used to say:
"There are two Great Sins in the world...
..the Sin of Ignorance, and the Sin of Stupidity.
Only the former may be overcome." R.I.P. Dad.
http://linuxcounter.net/user/44256.html

[toc] | [prev] | [next] | [standalone]

#178118

Steve McIntyre <steve@einval.com> writes:

> rodolfo.medina@gmail.com wrote:
>>Hi all.
>>
>>I frehly installed Debian Sid in dual boot with Windows 10 on my brand new
>>Lenovo desktop pc but it won't boot into Debian system I suspect because of
>>the new Secure Boot policy.  I want to disable it but the problem is that
>>there's no Secure Boot option anywhere in its Bios.  In fact, in the Security
>>submenu, there are only the options for administrator and power-on password
>>setting.
>>
>>What do you suggest me to do?
>
> Are you totally sure it's a Secure Boot issue?

No.


> What exactly happens at boot? Does it just boot straight into the Windows
> installation?

It does.

> Have you managed to install Debian

I did.

> , or will it just not boot the installer?

It did boot it and the installation went - apparently - all right.


> If you go into the BIOS/firmware config program, does that show you a
> list of boot options including Windows?

What do you mean by BIOS/firmware config program?  I wouldn't know...

Thanks,

Rodolfo

[toc] | [prev] | [next] | [standalone]

#178122

rodolfo.medina@gmail.com wrote:
>Steve McIntyre <steve@einval.com> writes:
>> rodolfo.medina@gmail.com wrote:
>>>Hi all.
>>>
>>>I frehly installed Debian Sid in dual boot with Windows 10 on my brand new
>>>Lenovo desktop pc but it won't boot into Debian system I suspect because of
>>>the new Secure Boot policy.  I want to disable it but the problem is that
>>>there's no Secure Boot option anywhere in its Bios.  In fact, in the Security
>>>submenu, there are only the options for administrator and power-on password
>>>setting.
>>>
>>>What do you suggest me to do?
>>
>> Are you totally sure it's a Secure Boot issue?
>
>No.
>
>> What exactly happens at boot? Does it just boot straight into the Windows
>> installation?
>
>It does.
>
>> Have you managed to install Debian
>
>I did.
>
>> , or will it just not boot the installer?
>
>It did boot it and the installation went - apparently - all right.

Right, OK. Did the installer say it was booting in UEFI mode? It says
so prominently on the first bootloader screen. If so, then you clearly
don't have a Secure Boot problem if the installer worked.

Alternatively, you may have booted the installer in BIOS/CSM mode, in
which case it might install but fail to install a boot loader at the
end of the process. *Or* you have installed in UEFI mode, but the
firmware on your computer is just ignoring the Debian-installed boot
option. That's always possible on some bad UEFI implementations,
unfortunately.

>> If you go into the BIOS/firmware config program, does that show you a
>> list of boot options including Windows?
>
>What do you mean by BIOS/firmware config program?  I wouldn't know...

The BIOS setup menus, if that's clearer. 

Another option would be to boot the installer again in rescue mode and
have a look at what partitions you have, and what bootloader(s) you
can find on /boot/efi for a UEFI system.

-- 
Steve McIntyre, Cambridge, UK.                                steve@einval.com
< sladen> I actually stayed in a hotel and arrived to find a post-it
          note stuck to the mini-bar saying "Paul: This fridge and
          fittings are the correct way around and do not need altering"

[toc] | [prev] | [next] | [standalone]

#178125

Le 24/02/2017 à 01:32, Steve McIntyre a écrit :
>
> Alternatively, you may have booted the installer in BIOS/CSM mode, in
> which case it might install but fail to install a boot loader at the
> end of the process.

Even if the boot loader is successfully installed, it would be a 
BIOS/legacy bootloader, and the UEFI firmware usually gives higher 
priority to EFI boot loaders, Windows Boot Manager here.

  *Or* you have installed in UEFI mode, but the
> firmware on your computer is just ignoring the Debian-installed boot
> option. That's always possible on some bad UEFI implementations,
> unfortunately.

I have seen this too on a HP laptop. The workaround was to choose to 
install GRUB in the "removable path" (that's what Windows do).

[toc] | [prev] | [next] | [standalone]

#178132

pascal@plouf.fr.eu.org wrote:
>Le 24/02/2017 à 01:32, Steve McIntyre a écrit :
>>
>> Alternatively, you may have booted the installer in BIOS/CSM mode, in
>> which case it might install but fail to install a boot loader at the
>> end of the process.
>
>Even if the boot loader is successfully installed, it would be a 
>BIOS/legacy bootloader, and the UEFI firmware usually gives higher 
>priority to EFI boot loaders, Windows Boot Manager here.

It depends on the system - many let you choose the order.

>  *Or* you have installed in UEFI mode, but the
>> firmware on your computer is just ignoring the Debian-installed boot
>> option. That's always possible on some bad UEFI implementations,
>> unfortunately.
>
>I have seen this too on a HP laptop. The workaround was to choose to 
>install GRUB in the "removable path" (that's what Windows do).

Nod. That's why I added extra support for that in Grub... :-)

-- 
Steve McIntyre, Cambridge, UK.                                steve@einval.com
< liw> everything I know about UK hotels I learned from "Fawlty Towers"

[toc] | [prev] | [next] | [standalone]

#178120

On most Lenovo the boot menu is F12, see what this is telling you based
on what you have.  If F12 is not working, F11, or Fn according to this
list
https://craftedflash.com/info/how-boot-computer-from-usb-flash-drive
should work
Do you have a live linux dvd/usb
Rescatux is relatively small and I believe is based on some Debian and
repairs boot problems, repair grub, MBR, issues.

But why sid of all things?  A more stable distribution that DOES boot
can easily be rolled over to testing and sid later.

If all fails format the drive and get rid of that stupid system it came
with :)

Rodolfo Medina:
> Hi all.
> 
> I frehly installed Debian Sid in dual boot with Windows 10 on my brand new
> Lenovo desktop pc but it won't boot into Debian system I suspect because of the
> new Secure Boot policy.  I want to disable it but the problem is that there's
> no Secure Boot option anywhere in its Bios.  In fact, in the Security submenu,
> there are only the options for administrator and power-on password setting.
> 
> What do you suggest me to do?
> 
> Thanks for any help,
> 
> Rodolfo
> 

-- 
 "The most violent element in society is ignorance" rEG

[toc] | [prev] | [next] | [standalone]

#178147 — [solved?] Re: Secure Boot won't let boot into Debian

Rodolfo Medina <rodolfo.medina@gmail.com> writes:

> I frehly installed Debian Sid in dual boot with Windows 10 on my brand new
> Lenovo desktop pc but it won't boot into Debian system I suspect because of
> the new Secure Boot policy.  I want to disable it but the problem is that
> there's no Secure Boot option anywhere in its Bios.  In fact, in the Security
> submenu, there are only the options for administrator and power-on password
> setting.
>
> What do you suggest me to do?


I tried to install Debian again so to do as suggested by Pascal, i.e.  install
GRUB in the "removable path"; but this time strangely the installation wouldn't
proceed up to end and stopped at a certain point.  Then I was tired with all
that stuff, all those Legacy problems and so on, and did GiaThnYgeia's way and
formatted the drive and got rid of that stupid system it came with: now Debian
runs without problems.  I left some free space on disk so to install Windows 10
later on...  maybe ;-)

Thanks to all who helped.  Anyway, this experience tell us maybe how aggressive
anti-Linux policies are coming up...?

Cheers,

Rodolfo

[toc] | [prev] | [next] | [standalone]

#178148 — Re: [solved?] Re: Secure Boot won't let boot into Debian

Rodolfo Medina <rodolfo.medina@gmail.com> writes:

> Rodolfo Medina <rodolfo.medina@gmail.com> writes:
>
>> I frehly installed Debian Sid in dual boot with Windows 10 on my brand new
>> Lenovo desktop pc but it won't boot into Debian system I suspect because of
>> the new Secure Boot policy.  I want to disable it but the problem is that
>> there's no Secure Boot option anywhere in its Bios.  In fact, in the
>> Security submenu, there are only the options for administrator and power-on
>> password setting.
>>
>> What do you suggest me to do?
>
>
> I tried to install Debian again so to do as suggested by Pascal, i.e.
> install GRUB in the "removable path"; but this time strangely the
> installation wouldn't proceed up to end and stopped at a certain point.  Then
> I was tired with all that stuff, all those Legacy problems and so on, and did
> GiaThnYgeia's way and formatted the drive and got rid of that stupid system
> it came with: now Debian runs without problems.  I left some free space on
> disk so to install Windows 10 later on...  maybe ;-)
>
> Thanks to all who helped.  Anyway, this experience tell us maybe how
> aggressive anti-Linux policies are coming up...?

When I was trying to install Debian alongside with Windows 10, I noticed a lot
of small partitions that were there created by Windows I didn't understand what
for...  really stupid system...?

Rodolfo

[toc] | [prev] | [next] | [standalone]

#178155 — Re: [solved?] Re: Secure Boot won't let boot into Debian

...Just curiosity: I installed debian-8.7.1-i386-netinst.iso, but my machine is
an AMD, and everything went fine.  So what's that difference for?

Rodolfo

[toc] | [prev] | [next] | [standalone]

#178156 — Re: [solved?] Re: Secure Boot won't let boot into Debian

AMD64 is for 64bit Amd and Intel processors, i386 is a 32bit system for
old pre64 architectures.  So even though a 32bit will work on a 64bit
system I have yet to find a good reason for doing so.  The other way
around wouldn't work.

kat

Rodolfo Medina:
> ...Just curiosity: I installed debian-8.7.1-i386-netinst.iso, but my machine is
> an AMD, and everything went fine.  So what's that difference for?
> 
> Rodolfo
> 

-- 
 "The most violent element in society is ignorance" rEG

[toc] | [prev] | [next] | [standalone]

#178157 — Re: [solved?] Re: Secure Boot won't let boot into Debian

Le 25/02/2017 à 13:26, GiaThnYgeia a écrit :
> AMD64 is for 64bit Amd and Intel processors,

64-bit Intel *x86* processors. There was once another 64-bit 
architecture called ia64 used by Intel "Itanium" processors, not 
compatible with amd64.

> i386 is a 32bit system for
> old pre64 architectures.  So even though a 32bit will work on a 64bit
> system I have yet to find a good reason for doing so.

Here are some good reasons to use a 32 bit system on 64 bit hardware :
- You are tight on memory (e.g. embedded system).
- You need to run software available only for 32 bit architecture.

[toc] | [prev] | [next] | [standalone]

#178158 — Re: [solved?] Re: Secure Boot won't let boot into Debian

Pascal Hambourg <pascal@plouf.fr.eu.org> writes:

> Le 25/02/2017 à 13:26, GiaThnYgeia a écrit :
>> AMD64 is for 64bit Amd and Intel processors,
>
> 64-bit Intel *x86* processors. There was once another 64-bit architecture
> called ia64 used by Intel "Itanium" processors, not compatible with amd64.
>
>> i386 is a 32bit system for
>> old pre64 architectures.  So even though a 32bit will work on a 64bit
>> system I have yet to find a good reason for doing so.
>
> Here are some good reasons to use a 32 bit system on 64 bit hardware :
> - You are tight on memory (e.g. embedded system).
> - You need to run software available only for 32 bit architecture.

So, generally speaking, how do I know what to choose?  How do I check if my
machine is `64 or 32 bit', and what of all those different Debian .isos to
install?

Rodolfo

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.debian.user

csiph-web